bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

Analysis

max time kernel
164s
max time network
208s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
Size

1016KB
MD5

42df5da7913917fed19cfc1b72a8c160
SHA1

ad2f492cbcde0f11726e029bc014379f0e8992fe
SHA256

bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa
SHA512

ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2
SSDEEP

6144:NIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:NIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ktshlo.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "xtfhyodaxpywzfydxie.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpyxlykeyntoorhj.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "wpyxlykeyntoorhj.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mxypvaeq = "zxlpiarqpjuuzhcjfsqei.exe"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpyxlykeyntoorhj.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhftw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe

Executes dropped EXE 3 IoCs

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

pid process

328 uvlgepmyefv.exe
520 ktshlo.exe
560 ktshlo.exe

pid	process
328	uvlgepmyefv.exe
520	ktshlo.exe
560	ktshlo.exe

Loads dropped DLL 6 IoCs

Processes:

bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exeuvlgepmyefv.exe

pid	process
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
328	uvlgepmyefv.exe
328	uvlgepmyefv.exe
328	uvlgepmyefv.exe
328	uvlgepmyefv.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxhhwkxsndkghlcfx.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "wpyxlykeyntoorhj.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "khuxpgwuslvuyfzfamjw.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "khuxpgwuslvuyfzfamjw.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktshlo = "dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktshlo = "mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "mhstjymievdachzdwg.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "dxhhwkxsndkghlcfx.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpyxlykeyntoorhj.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ktshlo.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktshlo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "zxlpiarqpjuuzhcjfsqei.exe ."	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "wpyxlykeyntoorhj.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "dxhhwkxsndkghlcfx.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odidnweukvxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxhhwkxsndkghlcfx.exe"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "wpyxlykeyntoorhj.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktshlo = "wpyxlykeyntoorhj.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpyxlykeyntoorhj.exe ."	uvlgepmyefv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dprjqwbob = "wpyxlykeyntoorhj.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktshlo = "khuxpgwuslvuyfzfamjw.exe"	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktshlo = "mhstjymievdachzdwg.exe"	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "mhstjymievdachzdwg.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "khuxpgwuslvuyfzfamjw.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfjdmubqfpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxlpiarqpjuuzhcjfsqei.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "khuxpgwuslvuyfzfamjw.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wjmfnuaocl = "xtfhyodaxpywzfydxie.exe ."	ktshlo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\xhhxcgj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhstjymievdachzdwg.exe ."	ktshlo.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ktshlo.exektshlo.exeuvlgepmyefv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 whatismyipaddress.com
6 whatismyip.everdot.org
7 www.showmyipaddress.com

flow	ioc
2	whatismyipaddress.com
6	whatismyip.everdot.org
7	www.showmyipaddress.com

Drops file in System32 directory 25 IoCs

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\xtfhyodaxpywzfydxie.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\zxlpiarqpjuuzhcjfsqei.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\dxhhwkxsndkghlcfx.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\mhstjymievdachzdwg.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\khuxpgwuslvuyfzfamjw.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\qpejdwooojvwclhpmazotn.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\wpyxlykeyntoorhj.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\xtfhyodaxpywzfydxie.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\zxlpiarqpjuuzhcjfsqei.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\qpejdwooojvwclhpmazotn.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\zxlpiarqpjuuzhcjfsqei.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\mhstjymievdachzdwg.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\khuxpgwuslvuyfzfamjw.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\qpejdwooojvwclhpmazotn.exe	ktshlo.exe
File created	C:\Windows\SysWOW64\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\mhstjymievdachzdwg.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\xtfhyodaxpywzfydxie.exe	ktshlo.exe
File created	C:\Windows\SysWOW64\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\khuxpgwuslvuyfzfamjw.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\wpyxlykeyntoorhj.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\dxhhwkxsndkghlcfx.exe	ktshlo.exe
File opened for modification	C:\Windows\SysWOW64\wpyxlykeyntoorhj.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\dxhhwkxsndkghlcfx.exe	uvlgepmyefv.exe

Drops file in Program Files directory 4 IoCs

Processes:

ktshlo.exe

description	ioc	process
File created	C:\Program Files (x86)\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe
File opened for modification	C:\Program Files (x86)\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File created	C:\Program Files (x86)\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File opened for modification	C:\Program Files (x86)\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe

Drops file in Windows directory 25 IoCs

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
File opened for modification	C:\Windows\qpejdwooojvwclhpmazotn.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\qpejdwooojvwclhpmazotn.exe	ktshlo.exe
File opened for modification	C:\Windows\qpejdwooojvwclhpmazotn.exe	ktshlo.exe
File opened for modification	C:\Windows\wpyxlykeyntoorhj.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\zxlpiarqpjuuzhcjfsqei.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\dxhhwkxsndkghlcfx.exe	ktshlo.exe
File opened for modification	C:\Windows\khuxpgwuslvuyfzfamjw.exe	ktshlo.exe
File opened for modification	C:\Windows\dxhhwkxsndkghlcfx.exe	ktshlo.exe
File opened for modification	C:\Windows\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File opened for modification	C:\Windows\khuxpgwuslvuyfzfamjw.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\mhstjymievdachzdwg.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\xtfhyodaxpywzfydxie.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\wpyxlykeyntoorhj.exe	ktshlo.exe
File opened for modification	C:\Windows\mhstjymievdachzdwg.exe	ktshlo.exe
File opened for modification	C:\Windows\xtfhyodaxpywzfydxie.exe	ktshlo.exe
File opened for modification	C:\Windows\zxlpiarqpjuuzhcjfsqei.exe	ktshlo.exe
File opened for modification	C:\Windows\xtfhyodaxpywzfydxie.exe	ktshlo.exe
File opened for modification	C:\Windows\dxhhwkxsndkghlcfx.exe	uvlgepmyefv.exe
File created	C:\Windows\rfjdmubqfpqgbzkhtwkoirzgvkuvlgepm.bpt	ktshlo.exe
File opened for modification	C:\Windows\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe
File opened for modification	C:\Windows\mhstjymievdachzdwg.exe	ktshlo.exe
File opened for modification	C:\Windows\khuxpgwuslvuyfzfamjw.exe	ktshlo.exe
File opened for modification	C:\Windows\zxlpiarqpjuuzhcjfsqei.exe	ktshlo.exe
File created	C:\Windows\adwfdawaedtyivvhiadwfd.wae	ktshlo.exe
File opened for modification	C:\Windows\wpyxlykeyntoorhj.exe	ktshlo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exektshlo.exe

pid	process
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
560	ktshlo.exe
560	ktshlo.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
560	ktshlo.exe
560	ktshlo.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ktshlo.exe

description pid process

Token: SeDebugPrivilege 560 ktshlo.exe

description	pid	process
Token: SeDebugPrivilege	560	ktshlo.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exeuvlgepmyefv.exe

description	pid	process	target process
PID 2040 wrote to memory of 328	2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe	uvlgepmyefv.exe
PID 2040 wrote to memory of 328	2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe	uvlgepmyefv.exe
PID 2040 wrote to memory of 328	2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe	uvlgepmyefv.exe
PID 2040 wrote to memory of 328	2040	bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe	uvlgepmyefv.exe
PID 328 wrote to memory of 520	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 520	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 520	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 520	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 560	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 560	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 560	328	uvlgepmyefv.exe	ktshlo.exe
PID 328 wrote to memory of 560	328	uvlgepmyefv.exe	ktshlo.exe

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

uvlgepmyefv.exektshlo.exektshlo.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ktshlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ktshlo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	uvlgepmyefv.exe

C:\Users\Admin\AppData\Local\Temp\bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe
"C:\Users\Admin\AppData\Local\Temp\bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe
"C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe" "c:\users\admin\appdata\local\temp\bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa.exe*"
2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:328

C:\Users\Admin\AppData\Local\Temp\ktshlo.exe
"C:\Users\Admin\AppData\Local\Temp\ktshlo.exe" "-C:\Users\Admin\AppData\Local\Temp\wpyxlykeyntoorhj.exe"
3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:520

C:\Users\Admin\AppData\Local\Temp\ktshlo.exe
"C:\Users\Admin\AppData\Local\Temp\ktshlo.exe" "-C:\Users\Admin\AppData\Local\Temp\wpyxlykeyntoorhj.exe"
3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dxhhwkxsndkghlcfx.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxhhwkxsndkghlcfx.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhstjymievdachzdwg.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhstjymievdachzdwg.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
94d57dc110e62898185a47fbd9f549f1

SHA1
aee363927aa937262080c9a0ec442375a253d7d4

SHA256
bd4d1448af66b9b0a734bd039ea21a1a028b8704437b2c8f3c53399e1aa8b294

SHA512
867218ff8811f55738571b6e281b7614e1f64d986b748016a688ed6e81630ab2cb38167ca82a412dbc5555e7e8e6ffd2e2a46b62e28bec9410c9cd16a00dd9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
94d57dc110e62898185a47fbd9f549f1

SHA1
aee363927aa937262080c9a0ec442375a253d7d4

SHA256
bd4d1448af66b9b0a734bd039ea21a1a028b8704437b2c8f3c53399e1aa8b294

SHA512
867218ff8811f55738571b6e281b7614e1f64d986b748016a688ed6e81630ab2cb38167ca82a412dbc5555e7e8e6ffd2e2a46b62e28bec9410c9cd16a00dd9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wpyxlykeyntoorhj.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\dxhhwkxsndkghlcfx.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\mhstjymievdachzdwg.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\wpyxlykeyntoorhj.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\SysWOW64\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\dxhhwkxsndkghlcfx.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\dxhhwkxsndkghlcfx.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\khuxpgwuslvuyfzfamjw.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\mhstjymievdachzdwg.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\mhstjymievdachzdwg.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\qpejdwooojvwclhpmazotn.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\wpyxlykeyntoorhj.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\wpyxlykeyntoorhj.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\xtfhyodaxpywzfydxie.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
C:\Windows\zxlpiarqpjuuzhcjfsqei.exe

Filesize
1016KB

MD5
42df5da7913917fed19cfc1b72a8c160

SHA1
ad2f492cbcde0f11726e029bc014379f0e8992fe

SHA256
bab383faaa36e201782e0f267d168627760800752bd4ec7d9e7b9bdbd7a9c3aa

SHA512
ed2405d65612db9acdd4f0657d96a1432f12046c2c02e1753cfa5000ae47782eb64a8535226ff887e3f8c7dbfc6691028d520306477d3d4d3cd86c4a764781f2

Download Submit
\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
\Users\Admin\AppData\Local\Temp\ktshlo.exe

Filesize
684KB

MD5
1edef161628dc9568b6b2eb855d8cafc

SHA1
77308d3de8d01dcfecd6395338e72a23cf08bc93

SHA256
4e0c571e9696f430c55e55b5bcf645e1d11d4a918353ac2efba72f8b2dd48ec1

SHA512
ab056411d42394982308c33c969fd6bbb16763158ab9495473d721c59ac4829965d238b1d1cb46a5992f333cd3c4eb1d8b9317a9a9bbaedcc096d9c6127e2f32

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
94d57dc110e62898185a47fbd9f549f1

SHA1
aee363927aa937262080c9a0ec442375a253d7d4

SHA256
bd4d1448af66b9b0a734bd039ea21a1a028b8704437b2c8f3c53399e1aa8b294

SHA512
867218ff8811f55738571b6e281b7614e1f64d986b748016a688ed6e81630ab2cb38167ca82a412dbc5555e7e8e6ffd2e2a46b62e28bec9410c9cd16a00dd9cf

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
94d57dc110e62898185a47fbd9f549f1

SHA1
aee363927aa937262080c9a0ec442375a253d7d4

SHA256
bd4d1448af66b9b0a734bd039ea21a1a028b8704437b2c8f3c53399e1aa8b294

SHA512
867218ff8811f55738571b6e281b7614e1f64d986b748016a688ed6e81630ab2cb38167ca82a412dbc5555e7e8e6ffd2e2a46b62e28bec9410c9cd16a00dd9cf

Download Submit
memory/328-57-0x0000000000000000-mapping.dmp

Download
memory/520-63-0x0000000000000000-mapping.dmp

Download
memory/560-68-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download